Beyond Gravity Privacy Policy

Effective date: 10 September 2026 Version: 2026-09-10-v1

Advertising addendum: 18 October 2026, notice version 2026-10-18-v1. This addendum updates the website advertising practices below; it does not change the game's existing Terms or age requirements.

1. Who we are

Beyond Gravity is a location-based calisthenics game operated by:

Vivek Ganeshie, trading as Creator Flows Koningsvaren 3 2631 VD Nootdorp The Netherlands Dutch Chamber of Commerce (KvK): 42117969 Privacy contact: gainestics@gmail.com

In this Privacy Policy, “Beyond Gravity”, “we”, “us”, and “our” refer to Creator Flows.

Creator Flows is the controller of the personal data described in this Privacy Policy, except where a third-party service independently determines how it processes personal data.

2. What this Privacy Policy covers

This Privacy Policy explains how we collect, use, store and share personal data when you:

• create or use a Beyond Gravity account;
• sign in using email/password, Google or Apple;
• use the map and location-based gameplay;
• discover, visit or claim calisthenics parks;
• participate in quests, progression and achievements;
• use community or social features;
• upload a profile image;
• communicate through Gym Chat or World Chat;
• interact with our website or application.

Beyond Gravity is designed for users aged 16 and older.

3. Information we collect

Account and authentication information

When you create an account, we may process:

• your email address;
• your authentication account identifier;
• authentication and session information;
• account creation and login information.

Authentication is provided using Supabase Auth.

If you sign in with Google or Apple, that provider and Supabase may also provide authentication profile information such as your:

• email address;
• name;
• profile image;
• provider-related authentication information.

Our application may use your name to generate an initial username and may use your Google profile image as your initial Beyond Gravity avatar.

We do not copy Google or Apple access tokens or refresh tokens into Beyond Gravity gameplay database tables.

Supabase's current Google integration uses the standard OpenID/profile scopes required for Google authentication, including `openid`, email and profile information.

Profile information

Depending on how you use Beyond Gravity, we may store:

• username or display name;
• avatar/profile image;
• visual profile preferences;
• level, XP and progression;
• achievements;
• mastery/progression information;
• game statistics.

Some profile and gameplay information is designed to be visible to other Beyond Gravity players.

Location information

Location is a core part of Beyond Gravity.

When location-based functionality is active, your device may provide us with:

• latitude;
• longitude;
• location accuracy;
• timestamp of the location observation.

We use precise location to determine whether you are physically close enough to a calisthenics park to perform location-dependent actions.

For example, location may be used to:

• discover a park;
• begin or validate a park visit;
• verify training at a park;
• claim or interact with a location;
• protect the game against location spoofing or abuse.

Beyond Gravity does not currently store a continuous historical route of your raw GPS observations in its normal gameplay database.

However, we do store location-related gameplay history. This may include:

• the park you discovered;
• the park you visited;
• visit start and verification times;
• visit duration or status;
• park claims and ownership;
• timestamps of gameplay actions.

As a result, gameplay history can indirectly reveal that you were at or near a particular location at a particular time.

Gameplay and progression information

We may store:

• XP events;
• levels;
• achievements;
• quests and quest claims;
• mastery and progression records;
• discoveries;
• visits and training sessions;
• claims and ownership history;
• seasonal statistics;
• rewards and other game activity.

Social and community information

Where you use social features, we may process:

• friendships and social relationships;
• gym/community membership information;
• chat messages;
• notifications;
• interactions with other players.

Information you intentionally publish through community functionality may be visible to other users.

For example, Gym Chat and World Chat messages may be visible to signed-in Beyond Gravity players.

Do not publish personal information in public or community areas that you do not want other players to see.

Security and anti-abuse information

To protect players and preserve fair gameplay, Beyond Gravity may process information concerning suspicious activity, including:

• relevant park IDs;
• timestamps;
• calculated distances;
• calculated movement speed;
• suspicious location transitions;
• abuse/security events.

Precise GPS observations are used as input to location-verification systems, but the current application does not intentionally write raw GPS coordinates into custom application logs.

Legal acceptance records

We keep a private record showing that an authenticated user has:

• confirmed that they are at least 16 years old;
• accepted the applicable Terms of Service;
• acknowledged the applicable Privacy Policy.

We store:

• confirmation timestamps;
• Terms version;
• Privacy Policy version.

We deliberately do not collect your date of birth merely for this purpose.

The 16+ confirmation is a user declaration and is not identity-based age verification.

4. Why we use your information

We process personal data for the following purposes.

Under the GDPR, processing can be lawful where it is necessary for performance of a contract, compliance with law, legitimate interests, consent, or another basis set out in Article 6.

Where we rely on legitimate interests, those interests include:

• operating Beyond Gravity reliably;
• maintaining fair gameplay;
• preventing cheating and misuse;
• securing accounts and infrastructure;
• investigating technical failures;
• protecting Beyond Gravity and its users.

We do not treat your acknowledgement of this Privacy Policy as consent to every processing activity described in it.

5. Location permission

Your browser or operating system controls whether Beyond Gravity receives precise device location.

You may deny or revoke location permission through your browser or device settings.

Because location verification is fundamental to Beyond Gravity, some gameplay functionality may not work without location access.

We do not use precise location for advertising.

We do not sell precise location information.

6. Who receives information

We use third-party infrastructure and services to operate Beyond Gravity.

Supabase

Supabase provides:

• authentication;
• PostgreSQL database infrastructure;
• file storage;
• APIs and RPC functionality;
• Edge Functions;
• operational logging.

Our primary Supabase project is deployed in West EU (Ireland), AWS `eu-west-1`.

Supabase may use subprocessors in connection with providing its services.

Google

Google is used for optional Google sign-in and to provide web fonts.

When Google sign-in is used, authentication information is exchanged between Google and Supabase.

Google Fonts are requested by the user's browser to provide the fonts used by Beyond Gravity. Browser requests to an external font service necessarily provide normal network/request information to that service.

Apple

Apple is used for optional Sign in with Apple. When it is used, authentication information is exchanged between Apple and Supabase. Apple may provide an email relay address when you choose to hide your email.

CARTO

CARTO provides mapping styles, tiles or related basemap resources used by Beyond Gravity.

Your browser may therefore send CARTO information such as:

• network/request information;
• IP address;
• browser/device information;
• map tile/style requests.

The geographic areas requested as map tiles may also reveal which areas of the map are being viewed.

CARTO may process information outside the European Economic Area and describes international transfer safeguards in its privacy documentation.

7. International transfers

Our primary Beyond Gravity database is hosted in Ireland.

Some third-party services may nevertheless process information outside the European Economic Area, including in the United States.

Where applicable, international transfers are subject to safeguards required by data-protection law, which may include:

• adequacy decisions;
• the EU-U.S. Data Privacy Framework;
• Standard Contractual Clauses;
• other legally recognised safeguards.

The particular mechanisms may depend on the service provider and processing activity.

8. Public and player-visible information

Beyond Gravity contains social and competitive game mechanics.

Depending on the feature, other players may be able to see information such as:

• username/display name;
• avatar;
• achievements or progression;
• park ownership or claims;
• gameplay status;
• messages posted in Gym Chat or World Chat.

Do not use your profile, username, avatar or chat messages to publish information that you want to keep private.

We may change exactly how gameplay information is presented as Beyond Gravity develops, but we will not intentionally convert private information into public information without an appropriate product purpose and notice.

9. How long we keep information

We currently retain most account-linked gameplay information for as long as your Beyond Gravity account remains active.

This includes, where applicable:

• profile information;
• avatars;
• XP and progression;
• achievements;
• quests;
• discoveries;
• claims;
• visits and training history;
• chat messages;
• friendships/social relationships;
• notifications;
• seasonal statistics;
• anti-abuse and location-security records.

The current application does not use a general automatic expiry schedule for these records.

When your account is deleted, account-linked records are removed through our deletion process, database relationships and cleanup mechanisms.

Your profile avatar is also removed from Beyond Gravity-controlled storage during account deletion.

Certain data may be retained where necessary to comply with a legal obligation, resolve a dispute, protect the service against abuse, or establish or defend legal claims, where permitted by law.

Operational logs

Infrastructure providers generate technical logs for security, diagnostics and service operation.

Our current Supabase configuration provides approximately one day of API and database log retention on the Free plan.

These logs may include technical information such as:

• request paths;
• timestamps;
• response status;
• network information such as IP address;
• limited request metadata.

Beyond Gravity application code does not intentionally write raw GPS coordinates, authentication tokens or full location request payloads into custom logs.

10. Account deletion

You can delete your Beyond Gravity account from within the application.

Account deletion is designed to remove the authenticated user and account-linked Beyond Gravity data, including applicable:

• profile data;
• avatar files;
• progression;
• quests;
• discoveries;
• claims;
• visits;
• chat/social information;
• notifications;
• security/gameplay records.

Park records themselves are part of the Beyond Gravity world and are not removed merely because a particular player deletes their account.

Information belonging to other players is not deleted when you delete your account.

You do not need to accept a new version of the Terms of Service in order to access account deletion.

11. Browser storage and cookies

Facebook and Instagram advertising measurement (web only)

We use Meta Pixel, provided by Meta Platforms (including Meta Platforms Ireland Limited for EEA users), to measure website page views and completed new-account registrations and help optimize Facebook and Instagram ads. Meta can receive normal network/browser information (including IP address and user agent), the website page address (without search or # parts), advertising cookie identifiers, event time, and a randomly generated registration event identifier. We do not send email addresses, account IDs, profile data, precise location, park visits, workout records or other gameplay data to Meta. No customer matching or server-side conversion uploads are enabled. After you accept advertising, we send a page view each time you open a page of the website; this can show which pages (for example a park page) you opened, but not your location or whether you visited a park.

In regions requiring advertising consent, including the EEA and UK, we block the Pixel until you accept advertising. If your region cannot be determined, we also ask first. Elsewhere ordinary measurement may operate where permitted, while honoring rejection and browser opt-out signals. Terms acceptance or Privacy Policy acknowledgement does not grant advertising permission. The advertising tools are not enabled in the native iOS app.

You can accept or reject with equal ease and change your choice through the Cookie settings control available on the website. Rejection does not affect gameplay. Withdrawal stops future advertising reporting; it does not recall events already received by Meta. Events blocked when they occurred are not replayed after later acceptance. Email confirmation in another browser or an unverified registration path may not be measured.

We save a random browser-local visitor reference, your choices and timestamps, region and notice version, together with the notice text. Earlier acceptance evidence remains when you withdraw. These records remain in this browser until you clear its storage; they are not uploaded to our database or Meta. Registration intent and its random event ID are temporarily stored to distinguish a new signup from a returning login and consumed before reporting. Clearing storage removes local choices and evidence; in consent-required or unknown regions we ask again.

Meta may set advertising cookies such as `_fbp` when the Pixel is permitted and process advertising information under its own retention and international-transfer practices. See [Meta Privacy Policy](https://www.facebook.com/privacy/policy/) and [Meta Business Tools Terms](https://www.facebook.com/legal/technology_terms). We rely on consent for these advertising purposes in the EEA/UK. Contact us using the details below for privacy or withdrawal help.

Authentication storage

Supabase authentication sessions are stored in browser `localStorage`.

This may include authentication session tokens necessary to keep you signed in.

These tokens are used for authentication and are not advertising identifiers.

Interface preference

Beyond Gravity may use a cookie named `sidebar_state` for up to approximately 7 days to remember an interface preference.

This cookie is not used for advertising, cross-site tracking or profiling.

Third-party services requested by the browser may operate under their own storage and privacy practices.

12. Advertising data sharing

We do not sell your personal information.

Permitted Meta Pixel reporting shares the limited advertising measurement information described in section 11 with Meta for measurement and ad optimization. This can constitute sharing for targeted or cross-context behavioural advertising under applicable laws. Use Cookie settings to reject this sharing; we also honor applicable browser opt-out signals.

We do not use precise location information for targeted advertising.

We currently do not operate an advertising network or advertising-profile system in Beyond Gravity.

13. Your privacy rights

Depending on where you live, you may have rights concerning your personal data.

For users covered by the GDPR or similar laws, these can include the right to:

• request access to personal data we hold about you;
• correct inaccurate data;
• request deletion;
• restrict certain processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent where a specific processing activity relies on consent;
• lodge a complaint with a data protection authority.

Because Creator Flows is established in the Netherlands, you may contact the Autoriteit Persoonsgegevens. EEA residents may also contact the competent supervisory authority in their country.

To exercise a privacy right, contact gainestics@gmail.com.

We may need to verify that the request relates to your account before providing or changing account information.

14. United States privacy rights

Depending on your state of residence and whether the applicable state law applies to Beyond Gravity, you may have rights such as:

• access to personal information;
• correction;
• deletion;
• obtaining a copy of certain information;
• opting out of certain sale, sharing or targeted-advertising activities;
• appealing certain privacy-request decisions.

Beyond Gravity does not sell personal information. The limited Meta sharing described in section 11 may constitute sharing for targeted or cross-context behavioural advertising; reject it through Cookie settings or contact us for help.

If an applicable U.S. privacy law grants you a right, you may exercise it by contacting gainestics@gmail.com.

We will not discriminate against you for exercising privacy rights provided by applicable law.

15. Users under 16

Beyond Gravity is not intended for people under 16 years old.

Users must confirm that they are at least 16 before using the service.

We do not ask users to submit their date of birth as part of this confirmation.

If we become aware that an account belongs to someone who is not eligible to use Beyond Gravity, we may suspend or delete the account and associated personal data as appropriate.

If you believe someone under 16 is using Beyond Gravity, contact gainestics@gmail.com.

16. Security

We use technical and organisational measures intended to protect personal data.

These include measures such as:

• authenticated access;
• database Row Level Security;
• restricted privileged operations;
• server-side validation for sensitive account operations;
• access controls around private records;
• protected account-deletion procedures.

No online system can guarantee absolute security.

You are responsible for keeping your login credentials secure and for informing us if you believe your account has been compromised.

17. Automated gameplay systems

Beyond Gravity uses automated calculations to operate location-based gameplay and protect game integrity.

For example, the application may calculate:

• proximity to a park;
• distance travelled;
• movement speed;
• whether a location-based game action appears suspicious.

These mechanisms are used to operate and protect the game.

We do not use these systems to make decisions that produce legal effects concerning you or similarly significant effects outside the operation of Beyond Gravity.

18. Changes to this Privacy Policy

Beyond Gravity is under active development.

We may update this Privacy Policy as:

• new functionality is introduced;
• new service providers are added;
• data practices change;
• legal requirements change.

The current version and effective date will be displayed at the top of this Privacy Policy.

Where a change is material, we may require authenticated users to review the updated Privacy Policy before continuing to use Beyond Gravity.

19. Contact

For privacy questions, requests or complaints:

Creator Flows Vivek Ganeshie Koningsvaren 3 2631 VD Nootdorp The Netherlands KvK: 42117969 Email: gainestics@gmail.com

References

1. EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng 2. Supabase - Login with Google: https://supabase.com/docs/guides/auth/social-login/auth-google 3. Supabase - Project Regions: https://supabase.com/docs/guides/platform/regions 4. Supabase Data Processing Addendum: https://supabase.com/downloads/docs/Supabase%2BDPA%2B231211.pdf 5. Google Fonts - Getting Started: https://developers.google.com/fonts/docs/getting_started 6. CARTO Privacy Policy: https://carto.com/privacy/ 7. Supabase Pricing (log retention context): https://supabase.com/pricing 8. California Consumer Privacy Act (California Attorney General): https://oag.ca.gov/privacy/ccpa